Cross-Level Debugging for Static Analysers

Static analyses provide the foundation for several tools that
help developers find problems before executing the program
under analysis. Common applications include warning about
unused code, deprecated API calls, or about potential security
vulnerabilities within an IDE. A static analysis distinguishes
itself from a dynamic analysis in that it is supposed to termi-
nate even if the program under analysis does not. In many
cases it is also desired for the analysis to be sound, meaning
that its answers account for all possible program behavior.
Unfortunately, analysis developers may make mistakes that
violate these properties resulting in hard-to-find bugs in the
analysis code itself. Finding these bugs can be a difficult task,
especially since analysis developers have to reason about
two separate code-bases: the analyzed code and the analysis
implementation. The former is usually where the bug man-
ifests itself, while the latter contains the faulty implemen-
tation. A recent survey has found that analysis developers
prefer to reason about the analyzed program, indicating that
debugging would be easier if debugging features such as
(conditional) breakpoints and stepping were also available
in the analyzed program. In this paper, we therefore propose
cross-level debugging for static analysis. This novel technique
moves debugging features such as stepping and breakpoints
to the base-layer (i.e., analyzed program), while still making
interactions with the meta-layer (i.e., analysis implementa-
tion) possible. To this end, we introduce novel conditional
breakpoints that express conditions, which we call meta-
predicates, about the current analysis’ state. We integrated
this debugging technique in a framework for implement-
ing modular abstract interpretation-based static analyses
called MAF. Through a detailed case study on 4 real-world
bugs taken from the repository of MAF, we demonstrate how cross-level debugging helps analysis developers in locating
and solving bugs.